Photographs of children, home addresses and health notes deserve a deliberate decision, made before you share the link.
The default on the internet is public. Anything you don't explicitly protect is visible to anyone who finds the address, including search engines.
For family projects this matters more than for most. Decide early, not after the first relative asks whether Grandma's address is on there.
Three piles
Public: a welcome page, perhaps. Signed-in: everything about actual people. Administrators only: anything you'd be uncomfortable seeing forwarded.
Sensitive health information belongs in the last pile, and personal record-keeping tools are never a substitute for medical advice.
Test it by signing out
Sign out, open your site in a private window and look. Whatever you can see is what the world can see.
Keep reading